According to the FortiOS 7.6 Administration Guide and Fortinet hardware acceleration (NTurbo) documentation, the correct answer is A.
What NTurbo Is (FortiOS 7.6 – Verified)
NTurbo is a hardware-based acceleration feature available on specific FortiGate models. It is designed to improve antivirus and IPS performance when operating in flow-based inspection mode.
NTurbo works by creating a fast, optimized data path between:
FortiGate ingress interface
IPS/AV engine
FortiGate egress interface
This minimizes CPU involvement and reduces packet traversal overhead.
Why Option A Is Correct
A. For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.
This is exactly how NTurbo works, as documented:
NTurbo applies to flow-based inspection only
It accelerates IPS and antivirus scanning
It creates a dedicated fast path that bypasses unnecessary processing steps
This significantly improves throughput and lowers latency
This description matches Fortinet’s official explanation of NTurbo.
Why the Other Options Are Incorrect
B. NTurbo creates two inspection sessions
Incorrect. NTurbo does not duplicate sessions; it optimizes the packet path.
C. NTurbo offloads traffic to the content processor (proxy-based)
Incorrect. NTurbo does not apply to proxy-based inspection and does not offload to content processors.
D. NTurbo buffers the whole file and then sends it to the antivirus engine
Incorrect. Buffering entire files is a proxy-based behavior, not NTurbo.
